The fine for the organisation

  • Essential entity: from €25 000 up to €10 million or 2% of worldwide annual turnover, whichever is higher (Art. 29).
  • Important entity: from €12 500 up to €7 million or 1.4% of turnover.
  • These are the legal limits, not an amount charged for every gap.

What managers risk personally

  • Management must approve the cybersecurity measures, oversee them and complete training every two years (Art. 21).
  • If they do not, a manager can be fined personally €500 to €5 000 (Art. 29(4)).
  • For essential entities the authority can also seek a temporary ban from management functions.

Municipalities and public bodies

  • The turnover-based fine does not apply to administrative bodies.
  • The authority can issue binding instructions and warnings and order the breach to be announced publicly (Art. 27i(1)(7)).
  • If a binding measure is not complied with, the sanction on the organisation is €2 500 to €12 000 (Art. 28(1)). The personal fine for the head still applies.

The transition period is over

  • Sanctions were halved for breaches committed up to and including 1 June 2026 (Section 51).
  • Breaches after that date carry the full sanctions.

What reduces the risk

  1. A written management decision approving the measures and naming an owner.
  2. Completed and documented management training.
  3. A risk assessment and a plan with owners and deadlines.
  4. A clear process for who assesses and who reports an incident within 24 and 72 hours.
  5. Evidence that the measures work: records, minutes and tests.

Not sure whether NIS2 (EU cybersecurity directive) applies to you? Take the two-minute self-check. If it does, the quick assessment shows where to start in 10 working days.